<html>
<head><meta charset="utf-8"><title>Manual implementations of Unpin can be unsound? · general · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/index.html">general</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html">Manual implementations of Unpin can be unsound?</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="200737518"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200737518" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200737518">(Jun 12 2020 at 23:44)</a>:</h4>
<p>My coworker did something along the lines of </p>
<div class="codehilite"><pre><span></span><code><span class="k">struct</span> <span class="nc">Foo</span><span class="o">&lt;</span><span class="n">A</span><span class="o">&gt;</span><span class="p">(</span><span class="n">A</span><span class="p">);</span><span class="w"></span>
<span class="k">impl</span><span class="o">&lt;</span><span class="n">A</span><span class="w"> </span><span class="cm">/* note missing `: Unpin` */</span><span class="o">&gt;</span><span class="w"> </span><span class="nb">Unpin</span><span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="n">Foo</span><span class="o">&lt;</span><span class="n">A</span><span class="o">&gt;</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>
</code></pre></div>


<p>and I thought it looked sketchy, so I went ahead and constructed <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=a745113c1d70af29f53b22d6a7bcc112">https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=a745113c1d70af29f53b22d6a7bcc112</a> based mostly on the example of the self-referential struct from <a href="https://doc.rust-lang.org/stable/std/pin/index.html">std::pin</a> docs.</p>
<p>The code sample only uses <code>unsafe</code> to construct the actual self-referential struct and as per documentation it is sound because we know it doesn’t move the structures at that point. However I'm still able to <code>swap</code> two <code>Pin</code>ned structures explicitly marked <code>!Unpin</code>?</p>



<a name="200737538"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200737538" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200737538">(Jun 12 2020 at 23:44)</a>:</h4>
<p>Is that not unsound? Or am I going crazy?</p>



<a name="200737586"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200737586" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200737586">(Jun 12 2020 at 23:45)</a>:</h4>
<p>(Consider that <code>SelfReferential</code> in the example can be coming from e.g. an different crate entirely)</p>



<a name="200738252"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200738252" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200738252">(Jun 12 2020 at 23:56)</a>:</h4>
<p>The type <code>Foo</code> itself simply can not rely on any guarantess that <code>Pin</code> would otherwise provide. It locally gives up additional invariants, which is always safe.</p>



<a name="200738346"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200738346" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200738346">(Jun 12 2020 at 23:58)</a>:</h4>
<p>Right, and the sample code does not rely on it. It uses the "Foo"'s relaxation of the guarantees to move an actual unpin <code>A</code>.</p>



<a name="200738359"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200738359" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200738359">(Jun 12 2020 at 23:58)</a>:</h4>
<p>now that I think about it however, could it be the case that <code>Pin</code> only really applies its guarantees to the outermost type stored in it and does not operate transitively?</p>



<a name="200738506"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200738506" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200738506">(Jun 13 2020 at 00:01)</a>:</h4>
<p>I guess docs do say that if you read it hard enough.</p>



<a name="200738738"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200738738" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200738738">(Jun 13 2020 at 00:04)</a>:</h4>
<p>Yes, a type can not safely project to its fields.</p>



<a name="200758692"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200758692" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200758692">(Jun 13 2020 at 09:57)</a>:</h4>
<p><span class="user-mention silent" data-user-id="123586">nagisa</span> <a href="#narrow/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F/near/200738506">said</a>:</p>
<blockquote>
<p>I guess docs do say that if you read it hard enough.</p>
</blockquote>
<p>in fact the docs spend about two screens worth of space on the discussion of "Projections and Structural Pinning". the intention is that the fact that <code>Pin</code> does not always propagate to fields is really right in your face when you read the docs.</p>



<a name="200758696"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200758696" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200758696">(Jun 13 2020 at 09:57)</a>:</h4>
<p>feedback for how to improve the docs to be more clear is always welcome :)</p>



<a name="200762749"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200762749" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200762749">(Jun 13 2020 at 11:52)</a>:</h4>
<p>yeah, I spent time crafting the example first and reading the docs after ^^</p>



<a name="200762807"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200762807" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200762807">(Jun 13 2020 at 11:54)</a>:</h4>
<p>I really inferred that first from "A Pin&lt;P&gt; ensures that the pointee of any pointer type P has a stable location in memory," that occurs within the first couple paragraphs and the only confirmation/elaboration of this is way after a number of examples demonstrating how to use pin (which is what I referred to to craft my example)</p>



<a name="200762815"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200762815" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200762815">(Jun 13 2020 at 11:54)</a>:</h4>
<p>I’m not used to important details coming _after_ examples <span aria-label="slight smile" class="emoji emoji-1f642" role="img" title="slight smile">:slight_smile:</span></p>



<a name="200979272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Manual%20implementations%20of%20Unpin%20can%20be%20unsound%3F/near/200979272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Manual.20implementations.20of.20Unpin.20can.20be.20unsound.3F.html#200979272">(Jun 16 2020 at 07:02)</a>:</h4>
<p>hm, good point. at least some of these important details (such as the drop rule) refer to the examples to explain what the problem is. that's how the order came to be.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>